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We propose a prepare-and-measure scheme for quantum 
key distribution with 2-bit quantum codes. The protocol is 
unconditionally secure under whatever type of intercept-and- 
resend attack. Given the symmetric and independent errors 
to the transmitted qubits, our scheme can tolerate a bit error 
rate up to 26% in 4-state protocol and 30% in 6-state proto- 
col, respectively. These values are higher than all currently 
known threshold values for the prepare-and-measure proto- 
cols. Moreover, we give a practically implementable linear 
optics realization for our scheme. 

Introduction. Quantum key distribution (QKD) is dif- 
ferent from classical cryptography in that an unknown 
quantum state is in principle not known unless it is dis- 
turbed, rather than the conjectured difficulty of comput- 
ing certain functions. The first published protocol, pro- 
posed in 1984 [1], is called BB84 (C. H. Bennett and G. 
Brassard.) For a history of the subject, one may see e.g. 
[2]. Since then, studies on QKD are extensive. Strict 
mathematical proofs for the unconditional security have 
been given already [3-5]. It is greatly simplified if one 
connects this with the quantum entanglement purifica- 
tion protocol (EPF) [3,6-10]. Very recently, motivated 
for higher bit error rate tolerance and higher efficiency, 
Gottesman and Lo [11] studied the classicalization of 
EFF with two way communications (2-EFF). Their pro- 
tocol has increased the tolerable bit error rate of channel 
to 18.9% and 26.4% for 4-state QKD and 6-state QKD, 
respectively. Very recently, these values have been up- 
graded to 20% and 27.4% by Chau [12]. 

The type of prepare-and-measure QKD schemes is par- 
ticularly interesting because it does not need the very 
difficult technique of quantum storage. In this paper, 
we propose a new prepare-and-measure scheme with the 
assistance of 2-bit quantum codes. The linear optical re- 
alization is shown in Fig. (1,2). In our scheme, Alice shall 
send both qubits of the quantum codes to Bob, there- 
fore they do not need any quantum storage. Bob will 
first check the parity of the two qubits by the polarizing 
beam splitter (FBS) and then decode the code with post 
selection. The 2-bit code is produced by the SFDG pro- 
cess [13], see in Fig.(l). 
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ror only, a phase flip error only and both error, re- 
spectively. The detected bit (or phase) flip error rate 
is the summation of Ux (or cr^) error rate and Gy er- 
ror rate. The Z,X,Y basis are defined by the basis of 
{|0), |1)}, {|0) ± |1)}, {|0) ± z|l)}, respectively. 
Main idea. We propose a revised 2-EFF scheme which is 
unconditionally secure and which can further increase the 
thresholds of error rates given the independent channel 
errors. We propose to let Alice send Bob the quantum 
states randomly chosen from {:^(|00) -f |11)), ^(|00) - 

|11)), |00), |11)}. As we shall see, these states are just the 
quantum phase-flip error-rejection (QFFER) code for the 
BB84 state {|0), |1), ^(|0) + |1)), ^(|G) - |1))}. 

In our 4-state protocol, the tolerable channel bit-flip 
and phase-flip rate is raised to 26% for the symmetric 
channel with independent noise. (A symmetric channel 
is defined as the one with equal distribution of errors of 
CTa;, cr^, (jj,.) Note that the theoretical upper bound of 25% 
[11] only holds for those 4-state schemes where Alice and 
Bob only test the error rate before any error removing 
steps. However, this is not true with the delay of error 
test. Considering the standard purification protocol [7] 
with symmetric channel, one may distill the maximally 
entangled states out of the raw pairs whose initial bit-flip 
error and phase-flip error are 33.3% . In our 4-state pro- 
tocol, we delay the error test by one step of puriflcation 
with 2-bit QFFER code. This raises the tolerable chan- 
nel flipping rates. 

The QPFER code. We shall use the following QFFER 
code: 



^(|00) + |11))/V2 
|1)|G)--(|00)-|11))/V2. 



(1) 
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Here the second qubit in the left side of the arrow is 
the ancilla for the encoding. This code is not assumed 
to reduce the errors in all cases. But in the case that 
the channel noise is uncorrelated or nearly uncorrelated, 
it works effectively. Consider an arbitrary state a|0)i -I- 
/3|l)i (qubit 1) and an ancilla state [0)2 (qubit 2). Taking 
unitary transformation of Eq(l) we obtain the following 
un-normalized state: 

a(|G)i|0)2 + |l)i|l)2) + /3(|G)i|0)2-|l)i|l)2) (2) 

This can be regarded as the encoded state for a|0)i + 
/3|l)i. Alice then sends both qubits to Bob. In receiving 
them. Bob first takes a parity check, i.e. he compares 
the bit values of the two qubits in Z basis. Note that 
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this collective measurement does not destroy the code 
state itself. Specifically, the parity check operation can 
be done by the PBS in Fig. (2): there, states |0),|1) are 
for horizontal and vertical polarization photon states, re- 
spectively. Since a PBS transmits |0) and reflects |1), 
if incident beams (beam 1 and 2) of the PBS are both 
horizontally polarized or vertically polarized, there must 
be one photon on each output beams (beam 1' and 2'); 
if the polarizations of two incident beams arc one hori- 
zontal and one vertical, one of the output beams must be 
empty. After the parity check, if bit values are different. 
Bob discards the whole 2-qubit code, if they are same. 
Bob decodes the code. In decoding, he measures qubit 1 
in X basis, if he obtains 1+), he takes a Hadamard trans- 
formation iJ = ^ I ^ to qubit 2; if he obtains 

|— ) for qubit 1, he takes the Hadamard transformation 
to qubit 2 and then flips qubit 2 in Z basis. Suppose 
the original channel error rates of ax,<Ty,<Tz types are 
PxO,PyO,PzO, respectively. Let pjo = I - p^o - pyQ - p^Q. 
One may easily verify the probability distribution and 
error type for the survived and decoded states (qubit 2) 
in following table 
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The first column lists the various types of joint channel 
errors(JCE) before decoding, {a ® /?} denotes both a ® 
(3 and jS ® a. According to this table, the error rate 
distribution for the survived raw pairs after decoding is: 



Pi = 

Pz = 

Py = 

Px = 
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(3) 



{PIO + Pzo)'^ + {PxO + PyoY ' 



With this formula, the phase flip error to the decoded 
states is obviously reduced. Note that this formula does 
not hold for the correlated channel errors. Even though 
the noise of the physical channel is uncorrelated, in car- 
rying out the QKD task, we should not use this formula 
to deduce the flipping rates of the decoded qubits based 
on our knowledge of the physical channel noise, i.e., the 
values of pio,Pxo,Pyo,Pzo- But we can choose to directly 
test the error rate of the survived and decoded qubits 



and to see whether formula (3) indeed holds, based on 
our prior knowledge of physical channel noise. 
Our protocol with linear optical realization. In the BB84 
protocol, there are only four different states. Therefore 
Alice may directly prepare random states from the set 
of {^(|00) + 111)), ^(|00) - 111)), |00), 111)} and sends 
them to Bob. This is equivalent to first preparing the 
BB84 states and then encoding them by eq.(l). We pro- 
pose the following 4-state protocol with implementation 
of linear optics in Fig(l) and Fig(2): 
1 Alice prepares N 2-qubit quantum codes with of 
them being prepared in |00) or |11) with equal probabil- 
ity and 3N/4: of them being prepared in :^(|00) ± |11)) 
with equal probability. All codes are put in randomly 
order. She records the the "preparation basis" as X 
basis for code |00) or |11) ; and as Z basis for code 
(1 00) ± 1 11)). And she records the bit value of for the 

code |00) or -^HOO) + |11)); bit value 1 for the code |11) 
or --i=(|00) — |11)). She sends each 2-qubit code to Bob. 
In Fig.(l), any of the above four states can be produced 
from the nonlinear crystal by appropriately setting the 
polarization of the pump light [15]. 2 Bob checks the par- 
ity of each 2-qubit code in Z basis. He discards the codes 
whenever the 2 bits have different values and he takes 
the following measurement if they have same values: he 
measures qubit 1 in X basis and qubit 2 in either X basis 
or Z basis with equal probability. If Bob has measured 
qubit 2 in X (or ) Z basis, he records the "measurement 
basis" as Z (or ) X basis [16] and we shall simply call the 
qubit as Z-bit (or X-bit) latter on. If he obtains [+)[+), 
l+>|0), [-)]-) or |-)|0), he records bit value for that 
code; if he obtains \-)\+), |-)|1), |+)|-) or he 
records bit value 1 for that code. In our linear optical 
realization, Bob's detections are done by post selection 
in Fig. (2): If beam 1' and beam 2' each contains one pho- 
ton, beam 1 and beam 2 must have the same bit values. 
Otherwise, their bit values must be different. This re- 
quires Bob to only accept the events of two fold clicking 
with one clicked detector from {D1,D2} and the other 
clicked detector from {D3,D4,D5,D6}. All other types 
of events must be discarded. Moreover, according to the 
above mentioned corresponding rule, to those accepted 
events, clicking of D3 or D4 means measurement in Z ba- 
sis to beam 2', corresponding to "X basis" for his record; 
also, clicking of D5 or D6 means measurement in X basis 
to beam 2', corresponding to "Z basis" for his record. 
The two fold clicking of (D1,D6),(D1,D3),(D2,D5) or 
(D2,D3) corresponds to bit value of 0; two fold clicking 
of (D2,D6),(D2,D4), (D1,D5) or (D1,D3) corresponds to 
bit value 1. 3 Bob announces which codes have been 
discarded. Alice and Bob compare the "preparation ba- 
sis" and "measurement basis" of each bits decoded from 
the survived codes by classical communication. They dis- 
card those bits whose "measurement basis" disagree with 
"preparation basis" . Bob announces the bit value of all 
X-bits. He also randomly chooses the same number of 
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Z— bits and announces their values. If too many of them 
disagree with Ahce's record, they abort the protocoL 4 
Now they regard the tested error rates on Z-bits as the 
bit-flip rate and the tested error rate on X-bits as phase 
flip rate. They reduce the bit flip rate in the following 
way: they randomly group all their unchecked bits with 
each group containing 2 bits. They compare the parity 
of each group. If the results are different, they discard 
both bits. If the results arc same, they discard one bit 
and keep the other. They repeatedly do so for a number 
of rounds until they believe that both bit flip rate and 
phase flip rate can be reduced to less than 5% with the 
next step being taken. 5 They then randomly group the 
remained bits with each group containing r bits. They 
use the parity of each group as the new bits. 6 They use 
the classical CSS code [6] to distill the flnal key. 
Note that in this protocol, Since formula (3) is not uncon- 
ditionally true, Alice and Bob check the bit errors after 
decoding the 2-bit quantum codes. If the detected errors 
arc significantly larger than the expected values calcu- 
lated from eq.(3), they will abort the protocol. That is 
to say, if formula (3) really works, they continue, if it 
does not work, they abort it. After any round of bit flip 
error rejection in step 4, the error rate will be iterated by 
equation (1) in ref. [12]. After the phase error correction 
in step 5, the new error rate satisfles the inequality of for- 
mula (3) of ref. [12] provided that pi > 1/2. The above 
steps to remove the bit-flip error and phase-flip error are 
unconditionally true since Alice and Bob have paired the 
qubits randomly. Even though the errors of the decoded 
qubits arc arbitrarily correlated, the above steps always 
work as theoretically expected. 

Given Px,Py,Pz, if there exits a finite number k, after 
k rounds of bit-flip error-rejection, we can find a r which 
satisfy 



riPx +Py) < 5% 

g-2r(0.5-p.-p„)^ < 5%, 



(4) 



one can then obtain the unconditionally secure and faith- 
ful flnal key with a classical CSS code [6] . 

In the 4-statc protocol, we don't detect the (jy error for 
the states decoded from the survived codes, therefore we 
have to assume Py = after the quantum parity check 
and decoding. But we do not have to assume pyo = 0, 
actually Alice and Bob never test any error rate before 
decoding in the protocol. However, if the channel noise 
is symmetric and uncorrelatcd, after the quantum de- 
coding, both az error (pz) and ay error {py) are reduced, 
i.e., the detectable phase error rate has been reduced in 
a rate as it should be i.e., eq.(3). We then start from 
the un-symmetric error rate with assumption Py = and 
PxiPz being the detected bit-flip rate and phase- flip rate, 
respectively. After the calculation, we find that the tol- 
erable error rate of bit flip or phase flip is 26% for the 
4-statc protocol. Moreover, in the case that the channel 
error distribution itself isp^o = ^'tPxO = PzO, the tolerable 
channel error rate for our protocol is Pxo = PzO < 21.7%. 



The above protocol is totally equivalent to the one based 
on entanglement purification therefore it is uncondition- 
ally secure [14] . Here we give a simple security proof. 



Alice 




Bob 



FIG. 1. QKD scheme with 2-bit quantum codes. PBS: po- 
larizing beam splitter. NO: nonlinear crystals used in SPDC 
process, p: pump light in horizontal polarization, ul: unitary 

rotator, u2: phase shifter, ul takes the value of 0, n/2, n/A 
to produce emission state |00), \4>'^}, respectively. u2 can 
be either I or az 



RPBS 




RPBS 

FIG. 2. Bob's action in QKD scheme of figure(l). RPBS: 
Rotated polarizing beam splitter which transmits the state 
|-f) and reflects state |-)). BS: 50:50 beam splitter. D rep- 
resents for a photon detector. With RPBS, one may measure 
the incident beam in {|-|-), |— )} basis. 

Security proof. Consider two protocols, protocol PO 
and protocol P. In protocol PO, Alice directly sends Bob 
each individual qubits. In protocol P, Alice first encodes 
each individual qubits by a certain error rejection code 
and then sends each quantum codes to Bob. We denote 
encoding operation as E and parity check and decoding 
operation by D. Bob will flrst check parity of each code 
and decode the survived codes. After decoding, Alice 
and Bob continue the protocol. Suppose except for the 
operations of D and E everything else in protocol PO and 
protocol P is identical and operation _D or _E do not re- 
quire any information of the original qubit itself, then we 
have the following theorem: If protocol PO is secure 
with arbitrary lossy channel, then protocol P is 
also secure. The proof of this theorem is very simple. 
Suppose P is insecure. Then Eve. must be able to attack 
the final key by certain operation. Denote Eve's attack 
during the period that all codes are transmitted from 
Alice to Bob as A. Eve may obtain significant informa- 
tion to final key with operation A and other operations 
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(Q) after Bob receives the qubits. If this is true, then in 
protocol PO, Eve may take the operation of DAE in the 
same period and then send the decoded states to Bob, 
with all other operations identical to those in protocol P. 
(The time order is from right to left.) To Alice and Bob, 
it looks like that they are carrying out protocol PO with 
a lossy channel now, because Eve will have to discard 
some of the 2-bit quantum codes after the parity check 
in decoding. All final results from protocol PO with at- 
tack QUAE must be identical to protocol P with attack 
QA, since everything there with the two protocols are 
now the same. This completes our proof of the theorem. 
Our QKD protocol in previous section is just the modified 
Chau protocol [12] with encoding and decoding added. 
We can regard our protocol as P and Chau protocol as 
PO in applying our theorem. Since Gottesman-Lo pro- 
tocol [11] or Chau protocol [12] are all unconditionally 
secure with arbitrary lossy channel, we conclude that our 
protocol must be also unconditionally secure. 
6-state protocol. Our protocol can obviously be extended 
to the 6-state protocol [17]. In doing so, Alice just change 
the initially random codes by adding iV/4 codes from 
{i[(|00) + 111)) ± z(|00) - 111))]}. This is equivalent to 
-^({|00) =F «|11))}- She regards all this type codes as Y- 
bits. In decoding the codes, Bob's "measurement basis" 
is randomly chosen from 3 basis, X,Y and Z. All decoded 
X-bits, Y-bits and the same number of randomly cho- 
sen decoded Z will be used as the check bits. Since the 
Hadamard transform switches the two eigenstates of (t^, 
after decoding, whenever Bob measures qubit 2 in Y ba- 
sis, he needs to flip the measurement outcome so that to 
obtain everything the same as that in the 2-EPP with 
quantum storages [14]. In such a way, if the channel 
is symmetric. Bob will find py ^ Q. And he will know 
Px,Py,Pz exactly instead of assuming py = 0. This will 
increase the tolerable error rate accordingly. In the case 
symmetric physical channel, our 6-state protocol toler- 
ates the flipping rate up to 30%. 

Subtlety of the "conditional advantage", un-symmetric 
effective channel. Although the advantage of a higher 
threshold is conditional, the security of our protocol is 
unconditional. That is to say, whenever our protocol 
produces any final key, Eve's information to that key 
must be exponentially close to zero, no matter whether 
Eve uses coherent attack or individual attack. Our pro- 
tocol is totally different from the almost useless proto- 
col which is only secure with uncorrelated channel noise. 
There are two conditions for the error threshold advan- 
tage: 

(1) The noise of physical channel should be the type 
where eq.(3) holds; (2) Eve. is not detected in the error 
test, i.e., the result of error test must be in agreement 
with the expected result given by eq.(3). 
Both conditions here arc verifiable by the protocol itself. 
The second condition is a condition for any QKD proto- 
col. The first condition is on the known physical channel 
rather than Eve's channel in QKD. In our protocol. Eve's 



attack must not affect the error rates detected on the de- 
coded qubits if she wants to hide her presence. That is to 
say, if Eve hides her presence, all results about the final 
key of our protocol can be correctly estimated based on 
the known properties of the physical channel, no mat- 
ter what type of attack she has used. Given a physical 
channel with its noise being un-correlated and symmetric 
and higher than the thresholds of all other prepare-and- 
measure protocols but lower than that of our protocol, our 
protocol is the only one that works. In practice, one may 
simply separate the 2 qubits of the quantum code sub- 
stantially to guarantee the un-correlation of the physical 
channel noise. This is to say, the error threshold advan- 
tage of our protocol is actually unconditional in practice. 
Loose ends in practice. Multi-pair emission in SPDC and 
dark counting of detectors have not been considered. We 
believe these issues can be resolved along the similar lines 
in the case of BB84 implemented with a weak coherent 
light source. 
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